Two Years Under the Eu Gdpr
Total Page:16
File Type:pdf, Size:1020Kb
TWO YEARS UNDER THE EU GDPR AN IMPLEMENTATION PROGRESS REPORT STATE OF PLAY, ANALYSIS, AND RECOMMENDATIONS This report is an Access Now publication. It is written by Estelle Massé. We would like to thank the Access Now team members who provided support, in particular Fanny Hidvégi, Donna Wentworth, and Juliana Castro, as well as our Mozilla Fellow Daniel Leufer. For more information, please visit: https://www.accessnow.org Contact: Estelle Massé | Senior Policy Analyst and Global Data Protection Lead [email protected] TWO YEARS UNDER THE EU GDPR AN IMPLEMENTATION PROGRESS REPORT | MAY 2020 EXECUTIVE SUMMARY It has been two years since the EU General Data Protection Regulation (GDPR) entered into application. We have witnessed the first positive impacts of the law but also the challenges authorities, courts, and people have faced in its enforcement. The past 12 months have proven particularly demanding for the protection of personal data and the application of the law as the European Union — and the world — has faced significant political and health crises. In our first GDPR progress report, published in May 2019, we wrote: “for most, 2018 was the year of data protection awakening in Europe. Still, for the GDPR to reach its full potential, 2019 must be the year of enforcement.”1 As it turned out, however, the last year has been a time of crisis. From public health to political crises, human rights abuses to administrative backlog, a series of challenges have put the robustness of the GDPR to test. In this report, we look at how the multiple crises of the last year have impacted the application of the GDPR. We will start by addressing some of the internal challenges, wherein the mechanisms established for enforcement of the GDPR have begun to show their limitations, with a particular focus on the lack of cooperation among data protection authorities (DPAs) and the lack of resources to do their work. We will then analyse how external crises, such as the United Kingdom’s decision to leave the European Union and the COVID-19 outbreak, are further challenging the application of the law. We close this report by putting forward a list of recommendations to enable the European Commission, EU states, and DPAs to address the hurdles here identified with the application of the GDPR. May 2020 not only marks the second anniversary of the GDPR, it is also the first official review of the law to be conducted by the EU institutions.2 Access Now has contributed to the process by providing comments to the European Commission through our membership in the multistakeholder expert group on the implementation of the law.3 1 Access Now, One year under the EU GDPR, 2019. https://www.accessnow.org/cms/assets/uploads/2019/07/One-Year-Under-GDPR-report.pdf 2 European Union. Article 97 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), 2016. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN 3 Access Now. Access Now’s response to questions shared on the multi-stakeholder expert group to support the application of Regulation (EU) 2016/679 - Questions to inform the preparation of the evaluation report of May 2020 on the application of GDPR, 2020. 2 TWO YEARS UNDER THE EU GDPR AN IMPLEMENTATION PROGRESS REPORT The publication of this report, coinciding with the review process of the law, is an opportunity to highlight the successes of the GDPR. These include its robustness and ability to provide human rights safeguards during crises; its role in advancing and protecting our rights in the EU; its capacity as a reference point globally, establishing the EU as a world leader in the field of data protection; and more. But we must also reflect on the challenges, such as how the law has been misused in efforts to silence journalists and NGOs, and how the slow pace of enforcement, exacerbated by the lack of cooperation between DPAs, has threatened to undermine the GDPR’s long-term capacity to change private-sector norms and practices with regard to data protection. In our report, we further note a disconnect between the rate of enforcement and the perception of enforcement by the public. Data show that DPAs have opened investigations and imposed fines at an exponentially increasing rate since May 2018. However, in some cases it is yet not clear what the impact will be of these enforcement measures, and we continue to wait for the resolution of landmark cases with the potential to force broad changes in invasive data-harvesting behaviour. Opponents of the GDPR are meanwhile using the review process as an opportunity to seek a change of the text, and with it, to remove many of the provisions that safeguard our rights. It would be ill-advised for the EU to reform or re-open the GDPR before it has been adequately implemented, applied, and enforced. It took the EU institutions and member states five years to negotiate the GDPR under immense external pressure to compromise, so it is perhaps not surprising that its application is not perfect two years in. But we will need more than patience to see the promises of the GDPR delivered. Concrete, urgent action is needed. It is imperative that DPAs work faster and in a more coordinated manner. The GDPR will be as strong as its weakest link and we cannot let that weak link be the enforcement process and the bodies in charge of representing our rights. Even the best law in the world will bring little benefit if it is not applied. Fear of legal costs and delay tactics have sharply limited the capacity of DPAs to move forward key cases against tech giants whose revenues are sometimes ten times higher than the DPAs’ budgets. To counter this imbalance, member states and the EU must give DPAs ample resources and protect their independence. As the GDPR has withstood two years of tests, crises, and challenges, we call on the EU institutions and the DPAs to move forward with the application and enforcement of the law. https://www.accessnow.org/cms/assets/uploads/2020/02/Access-Now%E2%80%99s-written-contribution-to-the-mult i-stakeholder-expert-group-to-support-the-application-of-Regulation-EU-2016679-January-2020.pdf 3 TWO YEARS UNDER THE EU GDPR AN IMPLEMENTATION PROGRESS REPORT TABLE OF CONTENTS EXECUTIVE SUMMARY 2 TABLE OF CONTENTS 4 INTRODUCTION 5 I. GDPR AND ENFORCEMENT: AN ADMINISTRATIVE CRISIS 6 A. Not Feeling (the) Fines 6 B. Data Protection Authorities Are Lacking Resources 8 C. One-Stop-Shop: Is the Cooperation System Broken? 12 II. THE GDPR IN TIMES OF POLITICAL, HEALTH, AND HUMAN RIGHTS CRISES 15 A. GDPR & Health Crisis 15 B. GDPR & Human Rights Abuses 17 C. GDPR & Brexit 19 III. RECOMMENDATIONS: MOVING THE GDPR FORWARD 21 1. Recommendations to Governments 21 2. Recommendations to the European Commission 22 3. Recommendations to the National Data Protection Authorities and the European Data Protection Board 22 CONCLUSION 23 4 TWO YEARS UNDER THE EU GDPR AN IMPLEMENTATION PROGRESS REPORT INTRODUCTION Two years ago, the EU General Data Protection Regulation became applicable. During its first year, the GDPR led to an increase in awareness of data protection rights among citizens, governments, and businesses. Although we had high hopes that its second year would be focused on enforcement, it turned out to be a year full of challenges for the GDPR. Over the last 12 months, the law has faced administrative and political crises and has had to adapt to a public health crisis. Data Protection Authorities (DPAs) struggled not only to work together but sometimes to work at all, straining their ability to enforce the law. The COVID-19 outbreak has tested the capacity of the law to provide for human rights protections in times of crisis. What is more, in a number of EU countries there have been attempts to misuse the GDPR to hurt the work of journalists and civil society actors. Finally, the United Kingdom’s decision to leave the European Union has consequences for the application of the GDPR and implications for the protection of personal data in Europe. In this report, we examine these challenges and provide recommendations to member states, the European Commission, and DPAs to address some of the most pressing shortcomings in the application of the GDPR. 5 TWO YEARS UNDER THE EU GDPR AN IMPLEMENTATION PROGRESS REPORT I. GDPR AND ENFORCEMENT: AN ADMINISTRATIVE CRISIS A. NOT FEELING (THE) FINES In May 2019, Access Now published a report in which we highlighted several issues with the implementation and enforcement of the GDPR. At the time, we brought attention to the slow resolution of complaints.4 Looking at the growth in the number and severity of sanctions and fines imposed since May 2018, it is clear Data Protection Authorities (DPAs) have significantly increased their GDPR enforcement activities.5 However, the market and users have yet to feel the full impact of these enforcement actions. How many fines were given under the GDPR? Explore the interactive chart From May 2018 to March 2020, DPAs levied 231 fines and sanctions.6 As shown in the graphic below, the number and size of these fines has grown exponentially since the 4 Access Now, One year under the EU GDPR, 2019. https://www.accessnow.org/cms/assets/uploads/2019/07/One-Year-Under-GDPR-report.pdf 5 ZDNet, Guess what? GDPR enforcement is on fire!, 2020.